Using honeypots to analyse anomalous Internet activities

Monitoring Internet traffic is critical in order to acquire a good understanding of threats to computer and network security and in designing efficient computer security systems. Researchers and network administrators have applied several approaches to monitoring traffic for malicious content. These techniques include monitoring network components, aggregating IDS alerts, and monitoring unused IP address spaces. Another method for monitoring and analyzing malicious traffic, which has been widely tried and accepted, is the use of honeypots. Honeypots are very valuable security resources for gathering artefacts associated with a variety of Internet attack activities. As honeypots run no production services, any contact with them is considered potentially malicious or suspicious by definition. This unique characteristic of the honeypot reduces the amount of collected traffic and makes it a more valuable source of information than other existing techniques. Currently, there is insufficient research in the honeypot data analysis field. To date, most of the work on honeypots has been devoted to the design of new honeypots or optimizing the current ones. Approaches for analyzing data collected from honeypots, especially low-interaction honeypots, are presently immature, while analysis techniques are manual and focus mainly on identifying existing attacks. This research addresses the need for developing more advanced techniques for analyzing Internet traffic data collected from low-interaction honeypots. We believe that characterizing honeypot traffic will improve the security of networks and, if the honeypot data is handled in time, give early signs of new vulnerabilities or breakouts of new automated malicious codes, such as worms. The outcomes of this research include: • Identification of repeated use of attack tools and attack processes through grouping activities that exhibit similar packet inter-arrival time distributions using the cliquing algorithm; • Application of principal component analysis to detect the structure of attackers’ activities present in low-interaction honeypots and to visualize attackers’ behaviors; • Detection of new attacks in low-interaction honeypot traffic through the use of the principal component’s residual space and the square prediction error statistic; • Real-time detection of new attacks using recursive principal component analysis; • A proof of concept implementation for honeypot traffic analysis and real time monitoring.

Why common factors in international bond returns are not so common

This paper analyzes the common factor structure of US, German, and Japanese Government bond returns. Unlike previous studies, we formally take into account the presence of country-specific factors when estimating common factors. We show that the classical approach of running a principal component analysis on a multi-country dataset of bond returns captures both local and common influences and therefore tends to pick too many factors. We conclude that US bond returns share only one common factor with German and Japanese bond returns. This single common factor is associated most notably with changes in the level of domestic term structures. We show that accounting for country-specific factors improves the performance of domestic and international hedging strategies.

Infrared spectroscopic investigation of the effects of titania photocatalyst on the degradation of linear low density polyethylene film for commercial applications

There is a need in industry for a commodity polyethylene film with controllable degradation properties that will degrade in an environmentally neutral way, for applications such as shopping bags and packaging film. Additives such as starch have been shown to accelerate the degradation of plastic films, however control of degradation is required so that the film will retain its mechanical properties during storage and use, and then degrade when no longer required. By the addition of a photocatalyst it is hoped that polymer film will breakdown with exposure to sunlight. Furthermore, it is desired that the polymer film will degrade in the dark, after a short initial exposure to sunlight. Research has been undertaken into the photo- and thermo-oxidative degradation processes of 25 ìm thick LLDPE (linear low density polyethylene) film containing titania from different manufacturers. Films were aged in a suntest or in an oven at 50 °C, and the oxidation product formation was followed using IR spectroscopy. Degussa P25, Kronos 1002, and various organic-modified and doped titanias of the types Satchleben Hombitan and Hunstsman Tioxide incorporated into LLDPE films were assessed for photoactivity. Degussa P25 was found to be the most photoactive with UVA and UVC exposure. Surface modification of titania was found to reduce photoactivity. Crystal phase is thought to be among the most important factors when assessing the photoactivity of titania as a photocatalyst for degradation. Pre-irradiation with UVA or UVC for 24 hours of the film containing 3% Degussa P25 titania prior to aging in an oven resulted in embrittlement in ca. 200 days. The multivariate data analysis technique PCA (principal component analysis) was used as an exploratory tool to investigate the IR spectral data. Oxidation products formed in similar relative concentrations across all samples, confirming that titania was catalysing the oxidation of the LLDPE film without changing the oxidation pathway. PCA was also employed to compare rates of degradation in different films. PCA enabled the discovery of water vapour trapped inside cavities formed by oxidation by titania particles. Imaging ATR/FTIR spectroscopy with high lateral resolution was used in a novel experiment to examine the heterogeneous nature of oxidation of a model polymer compound caused by the presence of titania particles. A model polymer containing Degussa P25 titania was solvent cast onto the internal reflection element of the imaging ATR/FTIR and the oxidation under UVC was examined over time. Sensitisation of 5 ìm domains by titania resulted in areas of relatively high oxidation product concentration. The suitability of transmission IR with a synchrotron light source to the study of polymer film oxidation was assessed as the Australian Synchrotron in Melbourne, Australia. Challenges such as interference fringes and poor signal-to-noise ratio need to be addressed before this can become a routine technique.

Evaluation of community participation for the development of culture-based fisheries in village reservoirs of Sri Lanka

In this paper an attempt is made to identify the socioeconomic characteristics of a community that influences the development and management of culture-based fisheries in village reservoirs of Sri Lanka. Socioeconomic data were collected from 46 agricultural farming communities associated with 47 village reservoirs in Sri Lanka. Principal component analysis indicated that scores of the first principal component were positively influenced by socioeconomic characteristics that are favorable for making collective decisions. These included leadership of the officers, age of the group, percentage of active members of the group, percentage of kinship of the group, percentage of common interest of the group, and percentage of participation of the group. The size of the group had negative effect on the first principal component. The principal component scores of communication were positively related to willingness to pay (P< 0.001). The communities with socioeconomic characteristics favouring collective decision making were in favor of culture-based fisheries. Homogeneity of group characteristics facilitated successful development of culture-based fisheries.

Distribution of polycyclic aromatic hydrocarbons in urban stormwater in Queensland, Australia

This paper reports the distribution of Polycyclic Aromatic Hydrocarbons (PAHs) in wash-off in urban stormwater in Gold Coast, Australia. Runoff samples collected from residential, industrial and commercial sites were separated into a dissolved fraction (<0.45µm), and three particulate fractions (0.45-75µm, 75-150µm and >150µm). Patterns in the distribution of PAHs in the fractions were investigated using Principal Component Analysis. Regardless of the land use and particle size fraction characteristics, the presence of organic carbon plays a dominant role in the distribution of PAHs. The PAHs concentrations were also found to decrease with rainfall duration. Generally, the 1- and 2-year average recurrence interval rainfall events were associated with the majority of the PAHs and the wash-off was a source limiting process. In the context of stormwater quality mitigation, targeting the initial part of the rainfall event is the most effective treatment strategy. The implications of the study results for urban stormwater quality management are also discussed.

Enhancing acoustic emission signals from multi-cylinder diesel engine

This paper presents techniques which can be viewed as pre-processing step towards diagnosis of faults in a small size multi-cylinder diesel engine. Preliminary analysis of the acoustic emission (AE) signals is outlined, including time-frequency analysis, selection of optimum frequency band. Some results of applying mean field independent component analysis (MFICA) to separate the AE root mean square (RMS) signals are also outlined. The results on separation of RMS signals show this technique has the potential of increasing the probability to successfully identify the AE events associated with the various mechanical events.

The impacts of traffic and rainfall characteristics on heavy metals build-up and wash-off from urban roads

An investigation into the effects of changes in urban traffic characteristics due to rapid urbanisation and the predicted changes in rainfall characteristics due to climate change on the build-up and wash-off of heavy metals was carried out in Gold Coast, Australia. The study sites encompassed three different urban land uses. Nine heavy metals commonly associated with traffic emissions were selected. The results were interpreted using multivariate data analysis and decision making tools, such as principal component analysis (PCA), fuzzy clustering (FC), PROMETHEE and GAIA. Initial analyses established high, low and moderate traffic scenarios as well as low, low to moderate, moderate, high and extreme rainfall scenarios for build-up and wash-off investigations. GAIA analyses established that moderate to high traffic scenarios could affect the build-up while moderate to high rainfall scenarios could affect the wash-off of heavy metals under changed conditions. However, in wash-off, metal concentrations in 1-75µm fraction were found to be independent of the changes to rainfall characteristics. In build-up, high traffic activities in commercial and industrial areas influenced the accumulation of heavy metal concentrations in particulate size range from 75 - >300 µm, whereas metal concentrations in finer size range of <1-75 µm were not affected. As practical implications, solids <1 µm and organic matter from 1 - >300 µm can be targeted for removal of Ni, Cu, Pb, Cd, Cr and Zn from build-up whilst organic matter from <1 - >300 µm can be targeted for removal of Cd, Cr, Pb and Ni from wash-off. Cu and Zn need to be removed as free ions from most fractions in wash-off.

Color and texture feature fusion using kernel PCA with application to object-based vegetation species classification

A good object representation or object descriptor is one of the key issues in object based image analysis. To effectively fuse color and texture as a unified descriptor at object level, this paper presents a novel method for feature fusion. Color histogram and the uniform local binary patterns are extracted from arbitrary-shaped image-objects, and kernel principal component analysis (kernel PCA) is employed to find nonlinear relationships of the extracted color and texture features. The maximum likelihood approach is used to estimate the intrinsic dimensionality, which is then used as a criterion for automatic selection of optimal feature set from the fused feature. The proposed method is evaluated using SVM as the benchmark classifier and is applied to object-based vegetation species classification using high spatial resolution aerial imagery. Experimental results demonstrate that great improvement can be achieved by using proposed feature fusion method.

Eigengaze : covert behavioral biometric exploiting visual attention characteristics

It is possible for the visual attention characteristics of a person to be exploited as a biometric for authentication or identification of individual viewers. The visual attention characteristics of a person can be easily monitored by tracking the gaze of a viewer during the presentation of a known or unknown visual scene. The positions and sequences of gaze locations during viewing may be determined by overt (conscious) or covert (sub-conscious) viewing behaviour. This paper presents a method to authenticate individuals using their covert viewing behaviour, thus yielding a unique behavioural biometric. A method to quantify the spatial and temporal patterns established by the viewer for their covert behaviour is proposed utilsing a principal component analysis technique called `eigenGaze'. Experimental results suggest that it is possible to capture the unique visual attention characteristics of a person to provide a simple behavioural biometric.

Prediction model of the buildup of volatile organic compounds on urban roads

A model to predict the buildup of mainly traffic-generated volatile organic compounds or VOCs (toluene, ethylbenzene, ortho-xylene, meta-xylene, and para-xylene) on urban road surfaces is presented. The model required three traffic parameters, namely average daily traffic (ADT), volume to capacity ratio (V/C), and surface texture depth (STD), and two chemical parameters, namely total suspended solid (TSS) and total organic carbon (TOC), as predictor variables. Principal component analysis and two phase factor analysis were performed to characterize the model calibration parameters. Traffic congestion was found to be the underlying cause of traffic-related VOC buildup on urban roads. The model calibration was optimized using orthogonal experimental design. Partial least squares regression was used for model prediction. It was found that a better optimized orthogonal design could be achieved by including the latent factors of the data matrix into the design. The model performed fairly accurately for three different land uses as well as five different particle size fractions. The relative prediction errors were 10–40% for the different size fractions and 28–40% for the different land uses while the coefficients of variation of the predicted intersite VOC concentrations were in the range of 25–45% for the different size fractions. Considering the sizes of the data matrices, these coefficients of variation were within the acceptable interlaboratory range for analytes at ppb concentration levels.

Psychometric properties of the parents' fever management scale in a Turkish population

Aim: This paper reports a study designed to assess the psychometric properties (validity and reliability) of a Turkish version of the Australian Parents’ Fever Management Scale (PFMS). Background: Little is known about childhood fever management among Turkish parents. No scales to measure parents’ fever management practices in Turkey are available. Design: This is a methodological study. Methods: Eighty parents, of febrile children aged six months to five years, were randomly selected from the paedaitric hospital and two community family health centers in Sakarya, Turkey. The PFMS was back translated; language equivalence and content validity were validated. PFMS and socio-demographic data were collected in 2009. Means and standard deviations were calculated for interval level data and p values greater than 0.05 were considered statistically significant. Unrotated principal component analysis was used to determine construct validity and Cronbach’s coefficient alpha determined the internal consistency reliability. Results: The PFMS was psychometrically sound in this population. Construct validity, confirmed by confirmatory factor analysis [KMO 0.812, Bartlett’s Specificity (χ² = 182.799, df=28, P < 0·001)] revealed the Turkish version to be comprised of the eight original PFMS items. Internal consistency reliability coefficient was 0.80 and the scale’s total-item correlation coefficients ranged from 0.15 to 0.66 and were significant (p<0.001). Interestingly parents reported high scores on the PFMS 34.52±4.60 (range 8-40 with 40 indicating a high burden of care for febrile children). Conclusion: The PFMS was as psychometrically robust in a Turkish population as in an Australian population and is, therefore, a useful tool for health professionals to identify parents’ practices, provide targeted education thereby in reducing the unnecessary burden of care they place on themselves when caring for a febrile child. Relevance to clinical practice. Testing in different populations, cultures and healthcare systems will further assist in reporting the PFMS usefulness in clinical practice and research.

An approach to statistical lip modelling for speaker identification via chromatic feature extraction

This paper presents a novel technique for the tracking of moving lips for the purpose of speaker identification. In our system, a model of the lip contour is formed directly from chromatic information in the lip region. Iterative refinement of contour point estimates is not required. Colour features are extracted from the lips via concatenated profiles taken around the lip contour. Reduction of order in lip features is obtained via principal component analysis (PCA) followed by linear discriminant analysis (LDA). Statistical speaker models are built from the lip features based on the Gaussian mixture model (GMM). Identification experiments performed on the M2VTS¹ database, show encouraging results

3D ellipsoid fitting for multi-view gait recognition

Gait recognition approaches continue to struggle with challenges including view-invariance, low-resolution data, robustness to unconstrained environments, and fluctuating gait patterns due to subjects carrying goods or wearing different clothes. Although computationally expensive, model based techniques offer promise over appearance based techniques for these challenges as they gather gait features and interpret gait dynamics in skeleton form. In this paper, we propose a fast 3D ellipsoidal-based gait recognition algorithm using a 3D voxel model derived from multi-view silhouette images. This approach directly solves the limitations of view dependency and self-occlusion in existing ellipse fitting model-based approaches. Voxel models are segmented into four components (left and right legs, above and below the knee), and ellipsoids are fitted to each region using eigenvalue decomposition. Features derived from the ellipsoid parameters are modeled using a Fourier representation to retain the temporal dynamic pattern for classification. We demonstrate the proposed approach using the CMU MoBo database and show that an improvement of 15-20% can be achieved over a 2D ellipse fitting baseline.